Questions tagged [capabilities]

POSIX Capabilities are a way to split full superuser privileges into smaller partitions of privileges. Use this tag for questions on managing and using capabilities.

Filter by
Sorted by
Tagged with
0
votes
1answer
27 views

Does “Polkit” make use of linux capabilities?

I know that some authentication programs like KDE's KAuth can use polkit as the backend.And what makes polkit special is that it can grant some specific privileges to a non-privileged process.A ...
0
votes
1answer
23 views

What does capsh --print actually do?

I understand that Linux capabilities are defined on processes/files. But when I do capsh --print, it tells me the capabilities of the user. So what exactly is capsh --print doing? Capabilities are ...
0
votes
1answer
113 views

Run openvpn as non-root user

I'm trying to run openvpn server within podman unprivileged container. Openvpn needs to be able to manage network interfaces (i.e. create tun interface, assign IP address to it, bring it up). On my ...
0
votes
1answer
25 views

Setting file capabilities in deb package fails

So, there is my piece of software, that has to be distributed via deb-packages, it contains a small custom server. That server requires ability to listen on a priviledged port, because explaining to a ...
0
votes
0answers
52 views

How to setcap wifi-menu on arch for non-root users?

I'm trying to run wifi-menu on arch as non-root. No setcap i've tried works. [root@lilegg johny]# setcap CAP_NET_ADMIN,CAP_SYS_ADMIN,CAP_NET_RAW,CAP_DAC_OVERRIDE=eip /usr/bin/wifi-menu [root@lilegg ...
0
votes
0answers
107 views

Unable to set right access capabilities

I have a process with file capabilities set. This process forks (clone) a child, which should inherit the set capabilities. Actually, the strace below (20897 is the process started with file ...
0
votes
0answers
36 views

Get CentOS server capabilities in human-readable form using Python

DISCLAMER: I have already post this question at stackoverflow; However, re-post it here as it may be more suitable considering the topic. Please let me know if this is not regarded as good practice. ...
4
votes
0answers
73 views

Is there something like 'sudo' but give only one capability not real root?

I want to run a one-time web server on port 80, which I will never run again. Is there something like 'sudo' that gives only temporary CAP_NET_BIND_SERVICE, not real root, to a process? So that we ...
0
votes
1answer
91 views

Are there some Unix or Unix-like operating systems that still treats the “root” user as the superuser?

Linux does not treat the "root" user as the superuser anymore, but rather Linux uses capabilities which gives a process privileges (I think BSD does a similar thing). So for example in older Linux ...
3
votes
1answer
62 views

Why is there no “set effective supplementary GIDs” syscall?

The "effecive user/group ID" of a process is what the OS uses to determine whether an action (such as opening a file) is permitted by the process. You can set the effective primary GID of the current ...
1
vote
0answers
94 views

htop - how can I enable the new metrics for “delay accounting”?

htop has some new metrics: PERCENT_CPU_DELAY (CPUD%) The percentage of time spent waiting for a CPU (while runnable). Requires CAP_NET_ADMIN. PERCENT_IO_DELAY (IOD%)...
0
votes
0answers
153 views

Run a single process that can fork and clone as a non-root-user

I wish to run a docker container which runs a single os process, forks a clone of itself through invoking '/proc/self/exe'. This process will be launched by a user of the container, who may be a ...
5
votes
2answers
2k views

What does the “ep” capability mean?

root@macine:~# getcap ./some_bin ./some_bin =ep What does "ep" mean? What are the capabilities of this binary?
0
votes
1answer
329 views

Capabilities to start a systemd service

I'm starting a process with the cap_kill capability and use this process to kill other services. However I'd like to be able to restart these service with a systemctl restart xxx Is there a ...
0
votes
1answer
294 views

setcap binary but with arguments?

I'm trying to start BoringTun with setcap in order for it to run unprivileged but still have the ability to fmark: root@67672793823c:/# setcap cap_net_admin+epi /usr/local/sbin/boringtun --foreground ...
3
votes
1answer
3k views

Docker running an app with NET_ADMIN capability: involved risks

I'm trying to run an app in a docker container.The app requires root privileges to run. sudo docker run --restart always --network host --cap-add NET_ADMIN -d -p 53:53/udp my-image My question is: ...
3
votes
1answer
1k views

Why is CAP_NET_ADMIN insufficient permissions for ioctl(TUNSETIFF)?

I'm trying to write a tun/tap program in Rust. Since I don't want it to run as root I've added CAP_NET_ADMIN to the binary's capabilities: $sudo setcap cap_net_admin=eip target/release/tunnel $getcap ...
0
votes
0answers
312 views

Give root's permission to restricted user using PAM and Linux capabilities

I want to give root's permission (or root account) to my test's user not using wheel-group or sudoers on CentOS 7. Instead I would like to use module pam_cap.so and linux capabilities. I try this: ...
1
vote
1answer
136 views

Difference between file capability and process capability

I am trying to understand POSIX Capabilities. Sometimes, when reading the documentation they refer to file capabilities and sometimes to process capabilities. What is the difference between file and ...
1
vote
1answer
415 views

Can you assign Linux capabilities to users?

In Solaris, I believe that you can assign privileges to users. I know that in Linux you can assign capabilities to executable files, but can you also assign capabilities to users?
4
votes
2answers
381 views

Does macOS and Solaris have “capabilities”?

Linux have capabilities, which are used to give a non-root process some privileges. Does macOS and Solaris also have capabilities? if not, do they have something similar to capabilities?
1
vote
3answers
228 views

Does a process that have the root user always have all of the capabilities available in Linux?

In Linux, a process that have a non-root user can have some capabilities assigned to it to increase its privileges. And a process that have the root user have all of the capabilities available, but ...
0
votes
0answers
38 views

Better use ACL or Capability to let users start a service?

My question is openned to other propositions too. An install sequence puts a binary in the directories (say bin1 in PATH_TO_BIN1). It configures a service in /etc/init.d The service has to be ...
0
votes
1answer
292 views

Difference between running a process as root and running process with all the linux capabilities

I have a docker container which runs perfectly fine in a kubernetes pod when privileged:true is set in the specification. But when I run the same docker container, by giving all the linux capabilities,...
3
votes
1answer
519 views

Ping not working in a new C container

I've been working on writing my own Linux container from scratch in C. I've borrowed code from several places and put up a basic version with namespaces & cgroups. Basically, I clone a new ...
3
votes
0answers
572 views

How to escape from a hardened chroot on Linux when only file capabilities are available to the attacker?

There is a chroot environment in /var/myroot, and an attacker has obtained arbitrary machine code execution in a process running as root (EUID 0) in the chroot. But the processes under control of the ...
6
votes
1answer
1k views

Is setcap deprecated?

I'm starting a webserver as non-root using a systemd unit file. I am getting listen tcp :80: bind: permission denied even though I already ran setcap cap_net_bind_service=+ep on the executable. ...
1
vote
0answers
70 views

Does every syscall require at most 1 capability on Linux?

I am trying to understand the relationship between capabilities and syscalls on Linux. As far as I know, the capabilities of a process are only ever considered when that process calls a syscall. When ...
1
vote
1answer
349 views

Why do I get permission denied when using unshare?

I'm exploring the namespace feature of linux kernel, using Archlinux. But I got some message that I can't explain the reason, could anyone explain them to me? xtricman⚓ArchVirtual⏺️~🤐export LANG=...
0
votes
1answer
795 views

Error with setcap CAP_SYS_TIME+ep /user/mybinaryprogram

I'm trying to use the capabilities (CAP_SYS_TIME) but when I run this command: setcap CAP_SYS_TIME+ep /user/mybinaryprogram on my system, I get the following error: Failed to set capabilities ...
2
votes
1answer
171 views

What properties of an unprivileged process are preserved during an `execve` call?

I am teaching an Operating Systems course and trying to wrap my mind around the fork/execve technique for creating new processes. My current understanding is that a fork make a complete copy of the ...
1
vote
2answers
212 views

How shall we understand the rules of capabilities with respect to exec()?

From The Linux Programming Interface: The permitted set is a limiting superset for the capabilities that can be added to the effective and inheritable sets. Does it mean that the permitted set ...
2
votes
1answer
556 views

How does Magisk on Android work as su without setuid and capabilities?

I've read in another answer that on Android the su binaries avoid needing to be setuid by using filesystem capabilities like cap_setuid. But then I tried to check this, and to my surprise, I found no ...
2
votes
1answer
2k views

Trying to disable some Bluetooth features on RPi3

I'm trying to make my RPi3 to be a bluetooth sink. My problem is that when I'm trying to connect my Windows 7 Laptop to my RPi Bluetooth sink, it is displayed like that : Sorry, it's in french. It ...
2
votes
1answer
269 views

Access /proc/pid/ns/net without running query process as root?

In a program I'm enumerating network namespaces by scanning /proc/pid/ for ns/net (sym) links. This program runs inside the "root" namespaces (original init) of the host itself. Normally, I need to ...
4
votes
1answer
880 views

Linux Capabilities with User Namespaces

I'm confused about how file capabilities work with regards to user namespaces. As I understand it, if a file has a capability, then any threads/process executing the file can attain the capability. ...
0
votes
0answers
24 views

Granting service specific capabilities

I have a sm-t365 rooted tablet. I've created a service in the init.rc file that all it does is create a folder in /data (which requires root), it works if in my service in init.rc i specify user root.....
10
votes
1answer
29k views

How to set capabilities with setcap command?

I would like to set up wpa_supplicant and openvpn to run as non-root user, like the recommended setup for wireshark. I can't find any documentation for what +eip in this example means: sudo setcap ...
11
votes
2answers
4k views

When using setcap, where is the permission stored?

Using setcap to give additional permissions to a binary should write the new permission somewhere, on storage or in memory, where is it stored ? Using lsof as is doesn't work because the process ...
5
votes
2answers
8k views

Can you list iptables as a non-root user and why?

Is it at all possible to execute iptables --list …. command without being root? Running it as non-root prints this: $ iptables --list iptables v1.4.21: can't initialize iptables table `filter': ...
0
votes
1answer
465 views

Systemd and AmbientCapabilities: debugging “Invalid argument” error

I am running Arch Linux. My problem originally manifested with Caddy web server, but it is not limited to it. Thus I have a simple unit to troubleshoot with a random binary (capsh): [Service] ...
3
votes
1answer
4k views

How to read the /proc/<pid>/fd directory of a process, which has a linux capability?

As a non-root user I am running a process. The process binary has been given a cap_sys_resource capability. Even though the process is owned by the same user, that user cannot read its /proc//fd ...
3
votes
0answers
218 views

setcap on dhclient appears to have no effect

I'm having a rather frustrating time getting dhclient to run from a normal user using setcap. Because of the environment I am working with, adding to sudoers is not an option. My attempt: sudo ...
6
votes
1answer
722 views

How do I run a process that wants to become root from a systemd service which is a regular user?

I have a service that I start using systemd. The service user and group are changed to a non-privileged user. [Service] ... User=regular_user Group=regular_user ... At some point the service needs ...
1
vote
1answer
910 views

Find out what capabilities a process needs

I want to allow run zfs zpool commands without root and sudo. I suppose that I need to give some capabilities to user, but how to get list of capabilities needed by some particular command? The OS is ...
15
votes
2answers
15k views

Unset `setcap` additional capabilities on excutable

An answer to Linux: allowing an user to listen to a port below 1024 specified giving an executable additional permissions using setcap such that the program could bind to ports <1024: setcap '...
4
votes
1answer
571 views

why is CAP_SYS_ADMIN needed for CLONE_NEWPID?

man 2 unshare tells us Use of CLONE_NEWPID requires the CAP_SYS_ADMIN capability and the suggested reading for further information man 7 pid_namespaces does not really discuss the presumable risk ...
5
votes
2answers
868 views

Why are not all permitted capabilities of a linux process effective all the time?

man 7 capabilities documents that the capabilities of a process on a linux box are recorded as three masks: permitted effective inheritable I have an idea to what extent the inheritable mask would ...
5
votes
1answer
785 views

How to identify what capabilities are required for a command?

When I run a command within a docker container, I see: # ip netns exec 9ee961d90990 ifconfig setting the network namespace "9ee961d90990" failed: Operation not permitted I can launch my container ...
5
votes
1answer
387 views

Linux File Capabilities are lost when I modify the file. Is this expected behavior?

When I modify a file, the file capabilities I had set earlier are lost. Is this the expected behavior? I first set a file capability: $ setcap CAP_NET_RAW+ep ./test.txt $ getcap ./test.txt ./test....